Authors:
Robert Luh
1
;
Marlies Temper
2
;
Simon Tjoa
3
and
Sebastian Schrittwieser
3
Affiliations:
1
St. Pölten University of Applied Sciences, Josef Ressel Center TARGET and De Montfort University, Austria
;
2
St. Pölten University of Applied Sciences, Austria
;
3
St. Pölten University of Applied Sciences and Josef Ressel Center TARGET, Austria
Keyword(s):
Security Model, Gamification, Attack Patterns, Controls, Malware, Intrusion Detection.
Abstract:
We present a meta model for comprehensive, time-enabled attacker/defender behavior ready for incorporation in a dynamic, imperfect information multi-player game that derives significant parts of its ruleset from established information security sources such as STIX, CAPEC, CVE/CWE and NIST SP800-53. Concrete attack patterns, vulnerabilities, and mitigating controls are mapped to their counterpart strategies and actions through practical, data-centric mechanisms. The gamified model furthermore considers and defines a wide range of actors, assets, and actions, thereby enabling a detailed assessment of cyber risks while giving analysts the opportunity to explore specific attack scenarios in the context of their own infrastructure.